Solved! Use INTRET.CNT (Trojan Comame) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

INTRET.CNT – Trojan Comame removal

File MD5 Virus Alias
INTRET.CNT 64092b65d2cd79275aa4f8354c7b99f0 Trojan Comame
INTRET.CNT 64092b65d2cd79275aa4f8354c7b99f0 Trojan Xema
INTRET.CNT 64092b65d2cd79275aa4f8354c7b99f0 Trojan PAM
INTRET.CNT 64092b65d2cd79275aa4f8354c7b99f0 Trojan Agent
INTRET.CNT 64092b65d2cd79275aa4f8354c7b99f0 Trojan Crypt

INTRET.CNT size: 184918 bytes
INTRET.CNT hash: 64092B65D2CD79275AA4F8354C7B99F0

Created files:

C:\Windows\Help\intret.cnt
C:\Windows\Syssrc32.exe
C:\Windows\System\applets.exe
C:\Windows\System\Explorer.exe
C:\Windows\System\fndfst32.exe
C:\Windows\System\mplayerw.exe
C:\Windows\System\Sysexp32.exe
%Temp%\1D87B2.dmp

Autostart registry keys:

HKLM\Software\Classes\txtfile\shell\open\command\Explore: %SystemRoot%\System32\NOTEPAD.EXE %1
HKLM\Software\Classes\txtfile\shell\open\command : C:\Windows\System\Sysexp32.exe %1
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System applets: C:\Windows\System\applets.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Syssrc32: C:\Windows\Syssrc32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fndfst32: C:\Windows\System\fndfst32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Explorer Shell: C:\Windows\System\Explorer.exe

Detected by UnHackMe:

INTRET.CNT
Default location: %WinDir%\HELP\INTRET.CNT

Dropper information:
MD5: 64092b65d2cd79275aa4f8354c7b99f0
File size: 184918 bytes

Leave a Reply